sniffer_raw_socket


http://discussion.forum.nokia.com/forum/showthread.php?104179-Sniffer-Raw-Socket


Hi,

I need to use "raw socket" to create a sniffer. I want to work at ip level. I have found many problems using in_sock.h. Has Somebody any examples? Where can I find further informations about "raw socket" usage? Can someone help me?

I'm ,thank a lots!!

mad81 

I have seen those examples but i haven't found nothing about "raw_socket".

I have some questions:

    * how use "KsoRawMode" to read ip level packets??
    * It's possible to read packets at level 2 of ISO/OSI?? I haven't found anything about this!!.



HELP!!!

mad81

You will need to use Packet socket instead of raw socket. Here it is


#include<sys/socket.h>
#include<netpacket/packet.h>
#include<net/ethernet.h>
#include <linux/tcp.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <net/if_arp.h>

char msg[4096];
struct ethhdr *eth = (struct ethhdr *)msg;
struct ip *my_iphdr;
struct tcphdr *tcph;
struct udphdr *my_udphdr;
struct icmphdr *my_icmphdr;
struct arphdr *arp_hdr;

/*
* Routine to classify
* protocols and
* display them
*/
void show_proto(int i)
{
int proto;
/*
*This will change the
*endianness
*/
proto = ((i>>8)&0xff)+((i << 8)&0xff00);
if (i == 1544)
{
printf ("Layer 2 protocol: ARP (0x0%2.2X)\n", proto);
arp_hdr = (struct arphdr *) (msg + sizeof (struct ethhdr));
printf ("Hardware type: %d", (((arp_hdr->ar_hrd)>>8)&0xff)+(((arp_hdr->ar_hrd) << 8)&0xff00));
if (1 == (((arp_hdr->ar_hrd)>>8)&0xff)+(((arp_hdr->ar_hrd) << 8)&0xff00))
printf (" (Ethernet)\n");
else
printf ("\n");

printf ("Protocol Type: %d", arp_hdr->ar_pro);
if (8 == arp_hdr->ar_pro)
printf (" (IP)\n");
else
printf ("\n");

printf ("Hardware Length: %d\n", arp_hdr->ar_hln);
printf ("Protocol Length: %d\n", arp_hdr->ar_pln);
printf ("opcode: 0x0%2.2X", (((arp_hdr->ar_op)>>8)&0xff)+(((arp_hdr->ar_op) << 8)&0xff00));

if (256 == arp_hdr->ar_op)
printf (" (request)\n");

else if (512 == arp_hdr->ar_op)
printf (" (reply)\n");
}

else if (i == 36864)
printf ("Layer 2 protocol: Loopback (0x0%2.2X)\n", proto);

else if (i == 32923)
printf ("Layer 2 protocol: AppleTalk (0x0%2.2X)\n", proto);

else if (i == 8)
{
printf ("Layer 3 protocol: IPv4 (0x0%2.2X)\n", proto);
my_iphdr = (struct ip *)(msg + sizeof (struct ethhdr));

printf ("Source %s\n", inet_ntoa (my_iphdr->ip_src));
printf ("Destination %s\n", inet_ntoa (my_iphdr->ip_dst));

if (my_iphdr->ip_p == 1 )
{
printf ("Layer 3 protocol: ICMP ");
my_icmphdr = (struct icmphdr *) (msg + sizeof (struct ethhdr) + sizeof (struct ip));

if (my_icmphdr->type == ICMP_ECHO)
printf ("type: ICMP_ECHO\n");

else if (my_icmphdr->type == ICMP_ECHOREPLY)
printf ("type: ICMP_REPLY\n");
}

else if (my_iphdr->ip_p == 6)
{
printf ("Layer 4 protocol: TCP\n");
tcph = (struct tcphdr *) (msg + sizeof (struct ethhdr) + sizeof (struct ip));
}

else if (my_iphdr->ip_p == 17)
{
printf ("Layer 4 protocol: UDP\n");
my_udphdr = (struct udphdr *) (msg + sizeof (struct ethhdr) + sizeof (struct ip));
}

else if (my_iphdr->ip_p == 112)
{
printf ("Layer 3 protocol: VRRP\n");
}
}

else if (i == 56710)
printf ("Layer 3 protocol: IPv6 (0x0%2.2X)\n", proto);

else
printf ("(0x0%2.2X) , %d\n", proto, proto);
}

/*
*This will listen to all packets
*at the link layer
*/

int main(void)
{
int socketfd,j;
struct sockaddr_ll skaddr;
socklen_t len;

skaddr.sll_protocol = htons(ETH_P_ALL);
socketfd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));

len = sizeof(struct sockaddr);

bind (socketfd, (struct sockaddr*) &skaddr, len);

while(1) {
recvfrom(socketfd, msg, sizeof (msg), 0, (struct sockaddr*) &skaddr, &len);
printf ("===================================================\n");
show_proto (eth->h_proto);
printf ("Destination Mac address: %2.2x.%2.2x.%2.2x.%2.2x.%2.2x.%2.2x\n", eth->h_dest[0], eth->h_dest[1], eth->h_dest[2], eth->h_dest[3], eth->h_dest[4], eth->h_dest[5]);
printf ("Source Mac address: %2.2x.%2.2x.%2.2x.%2.2x.%2.2x.%2.2x\n", eth->h_source[0], eth->h_source[1], eth->h_source[2], eth->h_source[3], eth->h_source[4], eth->h_source[5]);

printf("\n");
}
close(socketfd);
return;
}



njoy

-tuhin 